Ncc Group Plc · LSE:NCC

Ncc — nullcon International Security Conference

47 slides from Ncc's conference presentation

1. Slide 1: Fuzzing the easy way: Using Zulu

   http://nullcon.net the neXt security thing! nju necgroup” freedom from Goubt Fuzzing the easy way: Using Zulu Andy Davis, Research Director NCC Group International Security Conference

2. Slide 2: Who am I?

   Who am I? • NCC Group Research Director • >20 years in information security • Still very hands-on • Enjoy testing more unusual technologies • Also developing tools to test them

3. Slide 3: What is Zulu?

   What is Zulu? • Zulu is an interactive GUI-based fuzzer • Written in Python • As much as possible, input and output-agnostic • Multiple modules • Extendible via ZuluScript

4. Slide 4: Motivations behind the tool

   Motivations behind the tool • I had lots of unique “fuzzer scripts” • Fuzzing frameworks have a steep learning curve • Fuzzers should be quick and easy to setup • Wanted a point-and-click solution • Needed to be scriptable to add complexity where required

5. Slide 5: Zulu basics – the GUI

   http://nullcon.net the neXt security thing! nu Zulu basics — the GUI slolx! Fle Configuration InputMethod OuptNetod Fureng A 5 Ja\ 0 OO |= @ OO 9 |B== > Input data Mutation points: ators Ly / a FA Pitong stings] TP Userdefined |] T Format stings (J Bt oncep (byte) 1D Single byte brute force 1D. Bit

6. Slide 6: Zulu basics – typical data

   http-//nulicon.net the neXt security thing! Zulu basics — typical data Zuks - G\Users|andy\Research\zulu\dev\sessions\2012- le Confgraten put etd OuputNetod Fuzag A kd) er OO |r GOO Sad Input data: Mutation points: Mutators: Out (0000 byte 23_20. 29\session pelle) F tong stings 7 User defined Format

7. Slide 7: Zulu basics – the console

   http://nullcon.net the neXt security thing! nju Zulu basics — the console nullcon International Security Conference Goa eo

8. Slide 8: File structure

   File structure • /bin - Zulu binaries and custom.py (ZuluScript Python) • /crashfiles - When file fuzzing, files that have caused the target to crash • /fuzzdb - the fuzzer testcase files • /images - images used by the GUI • /logs - log files • /pcap - when Wireshark integration is enabled, auto-gen

9. Slide 9: Proxy-based network module

   http://nulicon.net the neXt security thing! nu Proxy-based network module International Security Conference

10. Slide 10: Configure the proxy

    hitp://nulicon net the neXt security thin nju ‘configu prony stings File | Configuration InputMethod Output Method Tergethost: figaaani7 File Configuration | Input Method OutputMethod Fuzzing Ay Proxy Settings Email Notification Settings oS Start Network Capture 7 —— A. Md wy) | port: 234 Import PCA

11. Slide 11: Use the standard network client

    Use the standard network client

12. Slide 12: Select some fuzz points

    http://nullcon.net the neXt security thing! elect some fuzz points ‘Fle Confguraton InputMethed Output Method Fuzang RK bdr OO ma OOO B= ‘Mutation points: Zulu - the interactive fuzzer A bd |r OO ee OOO |=) > Input data: Mutation points: Mutators GE] [unmodified Pxt:0 EI Pitong strings fj T Formatst

13. Slide 13: Select mutators

    http://nullcon.net the neXt security thing! nu Select mutators Mutators: a) [ User defined | | s f I Bit sweep (byte) ~ Single byte brute force [ Bit sweep (double byte) T~ Double byte attacks [~ Bit sweep (quad byte) T Quad byte attacks [~ Inverted bit sweep (byte) T~ Nullrepresentations | | [ Inve

14. Slide 14: Select output method

    http://nullcon net ulu - the interactive fuzzer the neXt security thing! Select output method File Configuration Input Method | Output Method Fuzzing Packet #0001 In (0019 #0 1 Packet #0003 In (0828 bytes) Packet #0004 Out (0326 bytes) Packet #0005 In (0059 bytes) Packet #0006 Out (0085 bytes) Packe

15. Slide 15: Start fuzzing

    http://nullcon net the neXt security thing! Start fuzzing he interactive fuzzer File Configuration InputMethod Output Method | Fuzzing R La Proxy: 9 CD | ruzzer Start Fuzzing » [=<]C:\Windows\system32\cmd.exe - zulu.py Input data: ts: Packet #0000 Out(0019 bytes) Z] [unmodified P Packet #0001 In (00

16. Slide 16: Instrumentation and triage

    http://nullcon.net the neXt security thing! Instrumentation and triage fuzzer [0 x) Fie Configuration InputMethod Output Method Fuzzng A kd = OO = 00 OE —__1% Input data: Mutation points: Mutators: \ [Gamodified Pkt:0 = Fuzzpoint:15-16 Pkt:2 Zulu #0006 Out (0085 #0007 In (0229 40008 Out (082 ioe ee

17. Slide 17: Other inputs: PCAP files

    http://nulicon.net the neXt security thing! nu Other inputs: PCAP files International Security Conference

18. Slide 18: Wireshark captures

    http-//nulicon.net the neXt security thing! Wireshark captures 1 Intel(R) 82577LM Gigabit Network Connection File Edit View Go Capture Analyze Statistics Telephony Tools Internals Help Sa ao a G@eeealines*aF TS S'/QQQA|SUMBA|B Filter: >| Expression... No. {Time {Source [Destination [Protocol {Info 6

19. Slide 19: Importing a PCAP

    http://nullcon net the neXt security thing! Importing a PCAP al Le] Ze Zulu - the interactive fuzzer File Configuration | Input Method Output Method Fuzzing L . Start Network Capture a aza Mi le Import PCAP Input data: Import File | econ | fates a Zu eractive fuzzer File Configuration InputMethod Ou

20. Slide 20: File module

    http://nulicon.net the neXt security thing! nu File module International Security Conference

21. Slide 21: Select input file

    http-//nulicon.net the neXt security thing! Select input file a& 4 Fe) Import PCAP Mu Search su a Input data: p Import File =-o@ [Date modfed [rye [sz | jel peal 2 oboe lsproi2 10:18 eyhenFle 20 recent laces @icbos 157672012 15:12 Python Fle 18 rey jean rspepoi22s1s§Tirhe 0 1D Research hex 187672012

22. Slide 22: Select file fuzzer + fuzz process

    Select file fuzzer + fuzz process

23. Slide 23: Fuzz process + debugging

    http-//nulicon.net the neXt security thing! nju Fuzz process + debugging P wero 0 Homey: oe weer ® Computer i Local Disk (C2) My Passport (D 33 Wremedashanng . Pa eos File name: [mplayer | [aN files ow Qpen = Status Statu Fuzzing stopped process 5620 crashed at address 0x626030ac Fuzzer selected: Fi

24. Slide 24: USB module

    http://nulicon.net the neXt security thing! nu USB module International Security Conference

25. Slide 25: Graphic USB

    http-//nulicon.net the neXt security thing! Graphic USB 5 Grapl ikeyboard.mqu] lolx! [3 Elle Edit View Operations Window Help 181 x! eck ain % reti/l oe M|RQ\? B ||Q)|| vous: 5. 06ov 63uA In|) © Control Transfer | @|° Lez Get Device Descriptor ue EFOIRIZTS é A device descriptor describes general inf

26. Slide 26: Import generator script

    http-//nulicon.net the neXt security thing! Import generator script [EW Zulu - the interactive fuzzer File Configuration InputMethod OutputMethod Fuzzing waza ba Proxy: u i Fuzzer: Input data: File Configuration | Input Method Output Method Fuzzing Packet #0000 In (0008 bytes) « = Packet #0001 Out(0

27. Slide 27: Select USB fuzzer

    http-//nulicon.net the neXt security thing! nu Select USB fuzzer [Ei Zulu - the interactive fuzzer File Configuration Input Method | Output Method Fuzzing A bdo GO fee (DOes Qe bytes) «| |Fuzzpoint:3-3 Pkt:1 i} Input data: Mutation points: Packet # Out Packet #0002 Out (0008 Packet #0003 Out (0002 g

28. Slide 28: Fuzzer running

    //nulicon.net the neXt security thing! Fuzzer running Kk O |=: O OO ee B= Mutation points: Mutators: @ Sah ne a S ae TG] fFezepoine:3-3 Pee: a c c Vbus: |5.092V 630A gy r 2 =I) F F 3 ox | a rt rt 6: cr ae Current Address: 0:249 rc r g HighestAddress: 0x249 r r 1 Progress: PC a ae Status a Pr te ted

29. Slide 29: Serial module

    http://nulicon.net the neXt security thing! nu Serial module International Security Conference

30. Slide 30: Serial settings

    http-//nulicon.net the neXt security thing! nju Serial settings [Eq Zulu - the interactive fuzzer File Configuration | Input Method OutputMethod Fuzzing Start Network Proxy A td OOw Import PCAP Input data: I File Mutation points: Import USB Generator Script x! Port settings port > baudrate 9600 ¥ yY

31. Slide 31: Serial data capture

    http://nullcon.net the neXt security thing! Serial data capture Zulu - the interactive fuzzer Pile e3) Fle Configuration InputMethod OutputMethod Fuzzing K 1 belo: @ O | nem 7 —— Input data: Mutation points: Mutators: ee, Packet #0000 F | 2] Pitengstrings (y I User defined {j T Format strings [ j I

32. Slide 32: Serial fuzzing

    http-//nulicon.net the neXt security thing! nju Serial fuzzing x Basics [Ej Zulu - the interactive fuzzer Port cOM1 7 File Configuration Input Method | Output Method Fuzzing Baudrate [9600 x b Network Fuzzer P Data Format ay } © reruzer WU beta —_—— USB Fuzzer Input data: Mutation points: Stop Bits

33. Slide 33: Wireshark integration

    http://nulicon.net the neXt security thing! nu Wireshark integration International Security Conference

34. Slide 34: Point to Wireshark binary

    http-//nulicon.net the neXt security thing! nju Point to Wireshark binary IP Enable ZuluScript (see "/bin/custom.py") Enable Wireshark integration! TO Enable VMware integration 5 | : Wesitcap 27/03/2012 18:12 Application 74KB (™ Computer Ses Local Disk (C:) @ mergecap 27/03/2012 18:12 Application 31

35. Slide 35: Auto-load Wireshark

    //nulicon.net the neXt security thing! Auto-load Wireshark Ti zulu_pcap_2012-06-25_15-37-19.pcap File Edit View Go Capture Analyze Statistics Telephony Tools Internals. Help Baa o a @xeeais @tZ/|S\8'|QaQ ww % 2 Fiter: | >| Bresson. No. {Time {Source [Destination [Protocol {info =i5/xi 1 0.000000 -0.

36. Slide 36: VMware integration

    http://nulicon.net the neXt security thing! nu VMware integration International Security Conference

37. Slide 37: Select file fuzzer + fuzz process

    Select file fuzzer + fuzz process

38. Slide 38: GUI-power

    http://nulicon.net the neXt security thing! nu GUIl-power International Security Conference

39. Slide 39: Adding a length field

    http://nullcon.net the neXt security thing! Adding a length field Bilirr 53 4a 42 72 90 00 00 00 ‘Add Fuzzpoint 20 4e 45 5 00 1b © w 4 » a £ 0 4d 49 43 52 DelFuzzpoint 4e 45 54 57 4f 46 54 20 4e _ AddFuzzRange 53 20 33 2e 30 6f 77 73 20 RSIS 72 6b 67 72 6f 7 4e 4d 41 4e 32 4e 4d 41 4e 20 Add length

40. Slide 40: No need to watch! Email alerts

    No need to watch! Email alerts

41. Slide 41: Select email settings

    http-//nulicon.net the neXt security thing! nju Select email settings [Zulu - the interactive fuzzer File | Configuration InputMethod Output Method Fuzzing Proxy Settings Ammo OW Oe Mutation points: VMware Settings Inp I | Email configuration Configue email settings gy SMTP Server address:Port [Emtp

42. Slide 42: Advanced features - ZuluScript

    Advanced features - ZuluScript

43. Slide 43: Using ZuluScript

    Using ZuluScript • How do you modify a packet after the mutator but before being processed by the target? • The answer is by using ZuluScript • Python script stored in a special file (/bin/custom.py) • Includes a sample UpdateContentLengthField() function

44. Slide 44: Access to data

    Access to data • self.packets_selected_to_send = list of packets selected to send [[packet number, data],[packet number, data]...] • self.all_packets_captured = list of all packets captured [[[source IP,source port],data], [[source IP,source port],data]...] • self.modified_data = list of all the dat

45. Slide 45: Bugs that Zulu has found

    Bugs that Zulu has found • Samba 'AndX' request remote heap overflow (CVE-2012-0870) • Oracle 11g TNS listener remote null pointer dereference • Apple OS X USB Hub Descriptor bNbrPorts Field Handling Memory Corruption • …and many others that haven’t been fixed yet

46. Slide 46: Zulu is available on Github

    Zulu is available on Github Zulu can be downloaded today at: https://github.com/nccgroup/zulu

47. Slide 47: Questions?

    http://nullcon.net the neXt security thing! nju ncecgroup* freedom from Questions? Andy Davis, Research Director NCC Group andy.davis ‘at’ nccgroup ‘dot’ com Ec International Security Conference

NCC Group — nullcon International Security Conference on 6ix